Republic Of Bulgaria National Report Second Extraordinary Meeting

Transcript

REPUBLIC OF BULGARIA NATIONAL REPORT SECOND EXTRAORDINARY MEETING UNDER THE CONVENTION ON NUCLEAR SAFETY Sofia, May 2012 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T CONTENTS CONTENTS 2 A. 5 INTRODUCTION BACKGROUND NATIONAL NUCLEAR PROGRAMME National Policy Nuclear Facilities REPORT CHARACTERISTICS Structure Scope B. COUNTRY RESPONSE TO THE ACCIDENT IMMEDIATE ACTIONS Initial Review and Verification Regulatory Conclusions EU STRESS TESTS STRESS TESTS OF THE BELENE NPP DESIGN Review and Assessment Conclusions Design Improvement Measures IAEA Peer Review of the Belene NPP design stress tests Report C. PRESENTATION OF TOPICS – KOZLODUY NPP 5 5 5 6 6 7 7 8 8 8 8 9 10 10 10 11 11 13 TOPIC 1 - EXTERNAL EVENTS 13 EARTHQUAKE 13 INITIAL SEISMIC DESIGN BASIS OF KOZLODUY NPP CURRENT SEISMIC DESIGN BASIS Reassessment of Seismic Design Basis ASSESSMENT OF THE ADEQUACY OF THE REASSESSED SITE SEISMIC DESIGN BASES Compliance with applicable legislative documents and standards Conclusion on the adequacy of the current design bases PROTECTIVE MEASURES AGAINST RLE AT UNITS 3 AND 4 SSCs required to maintain the FSP 3 and 4 in safe conditions Key operational measures to maintain SFP 3 and 4 in a safe state following an earthquake Evaluation of the indirect impact of the earthquake SEISMIC PROTECTIVE MEASURES FOR RLE AT UNITS 5 AND 6 SSCs required to put into and maintain Units 5 and 6 in safe shutdown state Main operational measures to put into and maintain Units 5 and 6 in safe shutdown state Assessment of indirect effects from the earthquake PROVISIONS MADE FOR SFSF PROTECTION AGAINST RLE SSCs required for maintaining SFSF in a safe state Maintaining the SFSF in a safe state following an earthquake Assessment of earthquake indirect effects MEASURES TO PROTECT DSFSF SEISMIC DESIGN BASES SSCs required to maintain DSFSF in a safe state Maintaining the DSFSF in a safe state following an earthquake 13 13 13 14 15 15 15 15 16 16 17 17 19 20 23 23 23 23 24 24 25 2 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Assessment of earthquake indirect effects POTENTIAL OFF-SITE IMPACTS ASSESSMENT OF SAFETY MARGINS AGAINST EARTHQUAKE Evaluation of units 3 and 4 safety margins against earthquake Evaluation of units 5 and 6 safety margins against earthquake Evaluation of SFSF safety margins against earthquake Evaluation of DSFSF safety margins against earthquake CONCLUSION DESIGN BASIS Flooding against which the plant is designed Conclusion on the adequacy of protections against external flooding ENSURING PLANT PROTECTION AGAINST MWL Kozloduy NPP Units 3 and 4 Kozloduy NPP Units 5 and 6 SFSF Main design provisions to prevent flooding impact Main operational measures for protection against external flooding Potential off-site impact EVALUATION OF SAFETY MARGINS AGAINST EXTERNAL FLOODINGS Definition of safety margins against external flooding Potential measures to enhance plant robustness against external flooding CONCLUSION ON THE IMPACT OF EXTERNAL FLOODING EXTREME METEOROLOGICAL IMPACTS ASSESSMENT OF METEOROLOGICAL PHENOMENA USED AS DESIGN BASIS CONCLUSIONS ON THE IMPACT OF EXTREME METEOROLOGICAL IMPACTS Assessment of impacts of extreme external events on structures Plant robustness against extreme external impacts Potential measures to enhance plant robustness against extreme meteorological impacts TOPIC 2 – DESIGN ISSUES 25 26 26 26 28 31 31 32 33 33 34 35 35 36 36 37 37 37 39 39 42 42 43 43 44 44 44 45 46 LOSS OF POWER SUPPLY NUCLEAR REACTORS – UNITS 5 AND 6 Units 5 and 6 SFPs Units 3 and 4 SFPs SPENT FUEL STORAGE FACILITY Measures to improve robustness at loss of power supply LOSS OF ULTIMATE HEAT SINK Units 5 and 6 nuclear reactors Units 5 and 6 SFPs Units 3 and 4 SFPs Spent fuel storage facility Measures to improve robustness at loss of ultimate heat sink Conclusion 46 46 51 52 53 53 54 54 60 60 61 61 61 TOPIC 3 - MANAGEMENT OF SEVERE ACCIDENTS 63 LICENSEE ARRANGEMENTS FOR ACCIDENT MANAGEMENT Personnel and management of shifts in normal operation Licensee arrangements for accident management Off-site technical assistance for management of accidents PROCEDURES, TRAINING AND EXERCISES POSSIBILITY TO USE THE EXISTING EQUIPMENT 63 63 63 65 65 67 3 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Measures that ensure the use of mobile devices Factors that can hinder accident management and evaluation of unforeseen circumstances Measures to improve accident management capabilities MAINTAINING THE INTEGRITY OF UNITS 5 AND 6 CONTAINMENT FOLLOWING SERIOUS FUEL DAMAGE Excluding the possibility of fuel damage/melting at high pressure Management of the risks due to generetion of hydrogen ih tne containment Prevention of containment overpressure prevention of melt through protection of the containment structure integrity Instrumentation required to maintain containment integrity Additional measures to maintain containment integrity after significant fuel damage MEASURES FOR MANAGEMENT OF ACCIDENTS WITH RADIOACTIVITY RELEASE Radioactivity releases in case of containment integrity loss at Units 5 and 6 Accident management after uncovering of the fuel in the spent fuel pools management of the Radioactive discharges from dry spent fuel storage facility Measures to improve limitation of radioactive discharges CONCLUSION TOPIC 4 – NATIONAL ORGANIZATIONS REGULATORY BODY TECHNICAL SUPPORT ORGANISATIONS MINISTRY OF ECONOMY, ENERGY AND TOURISM MINISTRY OF INTERIOR MINISTRY OF HEALTH MINISTRY OF ENVIRONMENT AND WATER COORDINATION AND INTERACTION LEGISLATIVE BASE 67 70 76 77 77 78 78 79 79 79 79 80 80 81 82 83 83 85 85 86 86 87 87 87 88 88 TOPIC 5 – EMERGENCY PREPAREDNESS AND RESPONSE 89 NATIONAL ORGANIZATION ACTIVITIES OF THE OPERATOR OPERATOR MEASURES TO IMPROVE EMERGENCY PLANNING ACTIVITIES OF THE REGULATOR PLANNED MEASURES AT NATIONAL LEVEL CONCLUSIONS OF REGULATORY AUTHORITY 89 92 93 94 96 96 TOPIC 6 – INTERNATIONAL COOPERATION CONVENTIONS BILATERAL COOPERATION INTERNATIONAL ORGANIZATIONS INTERNATIONAL WORKING GROUPS INTERNATIONAL PEER REVIEWS THE EXCHANGE OF OPERATING EXPERIENCE IAEA STANDARDS 97 97 97 99 100 100 101 101 LIST OF ABBREVIATIONS 103 ATTACHMENTS 104 4 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T A. INTRODUCTION The Republic of Bulgaria joined the Convention on Nuclear Safety (the Convention) in 1995. The Convention was ratified by an Act of the 37-th National Assembly on 14.09.1995, and entered into force on 24.10.1996. With its accession to the Convention, the country confirmed its national policy to maintain a high level of nuclear safety, to ensure the required transparency and to implement the highest safety standards. As a Contracting Party, the Republic of Bulgaria took part in the five previous review meetings, held respectively in 1999, 2002, 2005, 2008 and 2011, organised pursuant to Article 20 of the Convention. In accordance with Article 5, at each of them Bulgaria presented its National Reports on fulfilment of the obligations under the Convention. BACKGROUND On 11-th March 2011, Japan suffered the biggest earthquake in its history, called by the Prime Minister of Japan Naoto Kan, "the most serious challenge since the Second World War." Confirmed casualties are about 16,000 people and 4,000 are missing, while nearly 500,000 buildings were damaged or destroyed. The earthquake with epicentre in the Tohoku region and magnitude 9.0 on the Richter scale was recorded about 110 miles from the site of NPP Fukushima Dai-ichi (Fukushima 1). Earthquake generated a tsunami that at the region of Fukushima reached a height of 15 m. Following the earthquake and in particular the tsunami, a severe nuclear accident occurred at the Fukushima Dai-ichi NPP, which was rated at Level 7 on the INES scale (the highest level). Despite the fact that a tsunami is not a real threat to the territory of Bulgaria, the government took urgent measures to analyze the current situation in the light of the accident. As a full EU member, Bulgaria actively participates in the "stress tests" of the European nuclear reactors in operation, as a systematic reassessment of facilities safety margins against disastrous natural events that could lead to severe accidents. NATIONAL NUCLEAR PROGRAMME Bulgarian nuclear energy program was initiated in 1974 with the commissioning of the first unit of the Kozloduy NPP. Country nuclear power capacities are concentrated at the Kozloduy NPP site. NATIONAL POLICY Nuclear energy is a major factor in the country energy mix, in terms of high technology and production efficiency, competitive prices, and maintaining a high level of nuclear safety and radiation protection. A fundamental principle in the development of nuclear energy in the country is the national responsibility to ensure the safety of nuclear facilities. Bulgarian Energy Strategy till 2020 provides for the retention of the share of nuclear generated electricity. This strategy will be implemented by lifetime extension of existing nuclear units and construction of new nuclear capacities. Accepting that peaceful use of nuclear energy contributes to economic and social development and raise of living standards, the Republic of Bulgaria confirms that in the use of nuclear energy, protection of the health of individuals, the public as a whole, including future generations and the environment are of first and highest priority. 5 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T NUCLEAR FACILITIES Nuclear facilities, finally shutdown for decommissioning Kozloduy NPP Units 1 and 2 were finally shutdown for decommissioning in 2002. These two units are completely free of nuclear fuel and for this reason will not be considered in the report. Kozloduy NPP Units 3 and 4 were finally shutdown for decommissioning in 2006. For Units 3 and 4 it should be noted that irradiated fuel assemblies are stored at the lower racks of the near-reactor Spent Fuel Pools (SFP) of the two units, respectively SFP-3 and SFP-4. Despite the fact that complete release of the units from nuclear fuel it planned for the end of 2012, SFP-3 and SFP-4 were analyzed against extreme external impacts and loss of safety functions. Facilities, related to the safe storage of SF and RAW A facility for storage of spent nuclear fuel from WWER-1000 and WWER-440 reactors is available at the Kozloduy NPP site. The storage facility is a wet type and operates under an operating license issued by the BNRA. Safety analyses performed for the facility are reported hereafter. A new spent fuel storage facility of dry type is being constructed. The facility is located on-site and its capacity is sufficient to host all the spent fuel expected with from the operation of WWER-440 units. At present, the new facility is in a commissioning stage. The safety of the facility was reassessed for the purposes of this Report. Reactors in operation Kozloduy NPP Units 5 and 6 are equipped with WWER-1000/V320 type reactors and were commissioned respectively in 1987 and 1991. Since October 2009 Units 5 and 6 have renewed operating licenses - till November 2017 for Unit 5 and October 2019 for Unit 6. In light of the Fukushima Dai-ichi nuclear accident, the main focus of the performed safety reassessment falls over these two units. New Nuclear Capacity The Republic of Bulgaria planned the construction of a new nuclear capacity at the Belene site. Belene NPP was intended to include two WWER-1000 units of the A 92 design. Plant design was being reviewed by the Bulgarian Nuclear Regulatory Agency (BNRA) for more than four years. Numerous internal and external expert reviews and analyzes were conducted by both Bulgarian and international expert organizations. In March 2012 the Bulgarian government took a decision to terminate the Belene NPP project. This decision was lately confirmed by the Parliament. Irrespective of that fact, the report provides information on design safety reassessment performed. REPORT CHARACTERISTICS This Extraordinary National Report gives an overview of the main results of the thorough safety reassessment of the nuclear facilities in Bulgaria. Special attention is paid to the reassessment of the design basis and evaluated safety margins, as well as the planned improvement measures (at the level of government, regulatory authority, and licensee). 6 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T The report was prepared by the Nuclear Regulatory Agency with the active cooperation of licensees, other state authorities and organizations involved. The report was approved by the Council of Ministers of Bulgaria. STRUCTURE The report is structured in accordance with the guidelines issued by the International Atomic Energy Agency (IAEA) in the document "Second CNS Extraordinary Meeting (August 2012) Guidance for National Reports, Addendum". An attempt was made to prepare a selfstanding document with format and content, which does not require familiarization with the separate detailed licensees reports in respect to the various external events. Country actions in response to the Fukushima Dai-ichi NPP accident are presented under Section B of the report. Section C presents the detailed results of the analyzes. A summary table of planned measures, including the responsible organization and implementation timeframe is included as Appendix 1 of the report. SCOPE Reported analyses cover all operating nuclear facilities, located on the Kozloduy NPP site, namely: − Spent Fuel Pool of Unit 3 (SFP-3); − Spent Fuel Pool of Unit 4 (SFP-4); − Unit 5 – WWER-1000; − Unit 6 – WWER-1000; − Spent Fuel Pool of Unit 5 (SFP-5); − Spent Fuel Pool of Unit 6 (SFP-6); − Spent Fuel Storage Facility (SFSF) wet type; − Dry Spent Fuel Storage Facility (DSFSF); In accordance with the guidelines for the preparation of national reports, analyzes are focused on the following initiating events: − earthquake; − flooding; − other extreme weather conditions. For each of these events, the analyzes are directed towards: − definition of design basis and current status of components and structures; − identification of safety margins; − establishment of preventive measures against the respective impact. To determine the robustness of the abovementioned facilities against the initiating events, analysis also cover assessments of the consequences in case of loss of safety functions: − loss of power supply; − loss of ultimate heat sink; − combinations of the two. The following issues in respect of severe accident management are also included: − protective and management measures in loss of core cooling; − protective and management measures in loss of spent fuel cooling in SFP, SFSF and DSFSF; − protective and management measures in respect of containment integrity. 7 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T B. COUNTRY RESPONSE TO THE ACCIDENT IMMEDIATE ACTIONS Immediately after the Fukushima NPP accident, the Bulgarian Government stressed on the need for urgent action to reassess Kozloduy NPP preparedness to respond to emergencies. A meeting of the Prime Minister with the Kozloduy NPP management was held on 21-st March 2011, where the government requested the implementation of urgent actions at national level. INITIAL REVIEW AND VERIFICATION On 24-th March 2011, BNRA objectified the Government initiative and specified to Kozloduy NPP the regulatory requirements for review and verification of: − technical status, working conditions and operability of structures, systems and components (SSCs) involved in management of severe accidents; − monitoring and protection from external events (earthquake, external flooding, extreme weather conditions); − the provision of power supply to on-site consumers from the grid and from the independent sources of power supply; − monitoring and heat transfer to the ultimate heat sink. BNRA also requested verification of adequacy and applicability of the instructions and procedures for operators actions in case of design and beyond design basis accidents, as well as the capabilities of the operators and the emergency teams to follow them. These requirements aimed at taking prompt and short-term actions to reassess plant safety till the adoption of uniform requirements for all EU nuclear power plants, recently known as "stress tests". The operator was given one month to develop respective programs and three more months for implementation and reporting of results. Kozloduy NPP fulfilled these requirements and on 10-th June 2011 submitted to BNRA the respective review report. Main report findings demonstrated: compliance of the technical conditions of safety important SSCs with the design requirements; availability and applicability of instructions and procedures; and staff preparedness to act in emergencies. No significant gaps that require urgent safety improvements or restrictions on plant operations were identified. Despite the good results, a need was identified for optimization of Kozloduy NPP response to simultaneous impact to on-site facilities by external hazards. Proposed improvements could be divided into the following groups: − measures to improve preparedness for severe accident management; − measures to improve plant response to external and internal events and improve response preparedness; − measures to improve the reliability of external and independent power supply; − measures to improve staff preparedness of act in radiological emergencies, including review of the emergency plans; etc. REGULATORY CONCLUSIONS BNRA accepted the Kozloduy NPP report and assessed as adequate the improvement measures proposed. BNRA opinion is that assessment report does not highlight any significant deficiencies, which require urgent actions to increase plant response against external hazards, similar to those that caused the Fukushima event. 8 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T EU STRESS TESTS Following the Fukushima NPP accident, the European Community declared that “.. the safety of all nuclear power plants in the European Union should be reviewed on the basis of comprehensive and transparent risk assessment (stress tests)”. On 25-th March 2011, the Council of the European Union asked the EU countries, including Bulgaria to conduct "stress tests". "Stress tests" were developed based on initial ideas of WENRA (Western European Nuclear Regulators Association) and in May 2011 ENSREG (High Level Group on nuclear safety, spent fuel and radioactive waste) and the European Commission adopted a Declaration on the upcoming "stress tests". Specific methodology, deadlines for submission of national reports, transparency issues, etc. were presented in the Annexes to this Declaration. According to the ENSREG Declaration of 25 May 2011, "stress tests" are targeted reassessments of NPP safety margins, in the light of the Fukushima NPP accident: extreme external events, which could impact the fulfilment of the safety functions and result in a severe accident. Declaration was published on the ENSREG website. As a result, in late May 2011, the Nuclear Regulatory Agency has formally requested from the Kozloduy NPP to perform the demanded safety reassessment using the ENSREG methodology. Plans for submission of assessment reports were as follows: Licensee reports National reports Progress reports 15 August 15 September Final reports 31 October 31 December The main purpose of progress reports was to show that the Member State had already initiated the safety reassessment and had adopted and consistently applies the ENSREG methodology. Kozloduy NPP submitted its progress report in time (August 15, 2011), and the BNRA respectively submitted the Bulgaria National Progress Report to the European Commission also in time (September 15, 2011). The report is published on the BNRA website www.bnra.bg. All Member States progress reports are published on the ENSREG website. Bulgaria sent to the European Commission its final report on the stress tests in time (December 31, 2011) and published it at the BNRA website. According to the ENSREG Declaration, national reports are subject to peer reviews. Respective peer review mechanism, management board, team leaders and members were approved by ENSREG in OctoberNovember 2011. Submission to Council of the European Commission report on the final results from the "stress tests" is planned for the end of June 2012. It should be noted that issues of safety and security of European NPPs are reviewed in parallel and that terrorist threats are not included in the stress tests. 9 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T STRESS TESTS OF THE BELENE NPP DESIGN On 30 May 2011, BNRA requested from the NEK to perform "stress tests" of the Belene NPP design, although since April 2008 this design is being licensed by the BNRA and formally it does not fall into the category of nuclear power plants, for which safety reassessment against extreme external events is required. BNRA objective is to obtain further information in respect to Belene NPP safety, which to be used in the ongoing licensing process. REVIEW AND ASSESSMENT The following external initiating events were reviewed and reassessed by the stress tests: - earthquakes; - flooding; - extreme weather conditions. The reassessment cover the extent and frequency of occurrence of the maximum design initiating event, its progression and how structures, systems and components are designed and qualified to withstand the maximum design event. Review of initiating events cover also the evaluation of existing safety margins for the NPP as a whole and for individual structures, systems and components. Following the assessment of these margins, licensee should propose possible improvements to expand safety margins and to prevent or mitigate the consequences (cliff edge effects). Analyses cover the following key effects from loss of safety functions: − loss of power supply; − loss of ultimate heat sink; − combinations of the two. CONCLUSIONS General conclusions from the performed review and assessment of Belene NPP design are as follows: − with respect to beyond design basis accidents, the design provides appropriate safety systems, the automatic operation of which to maintain or restore the safety functions. If "Control of reactivity" is affected (failure of the scram system) two other safety systems are triggered: the quick boron injection system (passive system) and the emergency boron injection system (active system); − In impacts to the "core cooling" function, if the active systems for emergency core cooling are inoperable, water supply to the primary circuit is performed by passive systems (hydro accumulators: first and second stage); − In design and beyond design basis accidents, heat removal from the secondary side is performed by the SGs emergency cooldown system (active system). In unavailability of that system, SGs cooldown is carried out by the passive heat removal system (PHRS); − Beyond design basis accident (rupture of a primary pipe with a maximum diameter) and simultaneous loss of all on-site power sources lasting for 24 hours (design condition) does not lead to severe accident: no core melt, no steam-zirconium reaction, and respectively no risk of hydrogen explosion. The transfer to severe accident conditions is after the specified time interval if action to recover power supply are not taken. Severe accidents do not lead to loss of containment integrity. 10 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Loss of emergency power supply for more than 24 hours Even in total loss of AC power, safety functions are fulfilled by the passive systems and the Unit could be shutdown and maintained in a safe state for a long time. Analyses show that irrespectively of the combination of initiating events and the postulated additional failures, operation of only two of the PHRS trains ensure the safe state of the reactor fuel (no outcrop) for 159 days and in operation of the all 4 trains of the PHRS for 231 days. Loss of ultimate heat sink and containment cooling Even in loss of the main cooling water and loos of the spray ponds, the PHRS is capable of cooling down the reactor installation. Analyses of all postulated failure scenarios, that lead to severe accidents, show that with the operation of the passive safety systems containment design pressure will not be exceed. Loss of SFP cooling In loss of SFP cooling and loss of make-up capabilities and using conservative assumptions, there is sufficient time available before fuel outcrop in all possible arrangements of the spent fuel in the SFP. Management of severe accidents Severe accident management principles, incorporated in the design, are in conformity with the requirements towards last generation NPPs and respectively the design provides for the required technical measures to ensure implementation of the procedures for severe accident management. DESIGN IMPROVEMENT MEASURES As a result of the Belene NPP design stress tests, the following potential measures for further design improvement were proposed: - Enhancement of plant robustness against extremely low levels of the Danube River; - Enhancement of SFP robustness against decrease of cooling water level by implementation of administrative and technical measures; - Increase of safety functions monitoring time by provision of additional mobile AC sources or battery recharging; - Analyses of the possibilities for forced reduction of containment pressure as a supplementary measure in respect of severe accident management. As a conclusion, Belene NPP design stress tests demonstrated that plant design basis and plant safety level in case of occurrence of the analysed initiating events are properly addressed. Respectively, plant design provides for sufficient safety margins. Through the availability of both active and passive systems for severe accident management, Belene NPP is prepared for beyond design basis, namely major radioactive releases to the environment will be prevented. IAEA PEER REVIEW OF THE BELENE NPP DESIGN STRESS TESTS REPORT On a BNRA request, an IAEA international expert team performed peer review of the Belene NPP design stress tests report in the period 12-16 December 2011. The expert team included representatives from Czech Republic, France, Germany and the IAEA. Peer review was carried out on the basis of IAEA safety standards (including latest publications). 11 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Main findings • In respect to assessment of seismic hazards At the last IAEA mission to review the Belene site held in 1997, the suggested existence of a fault along the Danube banks was rejected. Following this mission, a probabilistic assessment of site seismic hazards was carried out using the state-of-the-art methods. The results of this evaluation are consistent with the results from the assessment of seismic hazards for the Bulgaria territory. An important study result is that the annual probability of exceeding the beyond design basis earthquake level (which is 40% higher than the design level) is about 10-5 times per year (i.e. once in 100 000 years). • In respect to seismic design Main design requirement is that the plant shall be safe at beyond design basis earthquake, which exceeds the design basis one with 40 %. Respectively, Belene NPP possesses significant inherent robustness against earthquakes. Conclusions According to the international experts, Belene NPP design ensures adequate technical provisions to cope with the entire spectrum of accidents, which should be considered by the design of the latest generation of NPPs (III +). Regarding the ENSREG "stress tests" criteria, as well as the IAEA safety standards, it was proven that significant safety margins and response time are available for almost all accident conditions. This is achieved mainly by application to the safety systems of various diversified principles, and due to the availability of large water inventory inside the containment structure. Another major experts finding is that the Belene NPP design includes certain inherent safety features to prevent severe accidents and to mitigate their consequences. The "stress tests" report conclusively demonstrated that the Belene design is reliable in terms of prevention and mitigation of severe accidents, since these accidents are analysed in the design. This includes preventive part of accident management, which is extremely reliable due to the combination of redundant active safety systems, supported by passive safety systems, as well as the specialized systems for mitigation of severe accidents consequences. According to the analyzes, core damage frequency is about 5,11 х 10-7 r/a with all events at reactor power operations; shutdown state; external fires, and respective external events being considered. These values indicate a high level of safety. The contribution of external events is only about 1.6% of the total core damage frequency. 12 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T C. PRESENTATION OF TOPICS – KOZLODUY NPP TOPIC 1 - EXTERNAL EVENTS EARTHQUAKE INITIAL SEISMIC DESIGN BASIS OF KOZLODUY NPP According to the design of Kozloduy NPP Units 1 and 2 (of 1973), the seismic activity in the region had been evaluated as below VI degree of the Medvedev-Sponheuer-Karnik seismic intensity scale (MSK-64). Following the March 1977 earthquake, with epicentre in the region of Vrancha mountain, site seismic re-evaluation had been performed. The Operational Base Earthquake (OBE) was set to VI degree with Peak Ground Acceleration (PGA) of 0.05g and Design Basis Earthquake (DBE) to VII degree with PGA of 0.1g. The following site maximum seismic impact had been adopted in the design of Kozloduy NPP Units 3 and 4: − OBE - VI degree by MSK-64 scale − DBE - VII degree by MSK-64 scale; − Surface response spectrum – the spectrum of Vrancha earthquake accelerogram dated 04.03.1977, recorded in Bucuresti and aligned to PGA of 0.1 g. The design of Units 5 and 6 had been developed based on the following seismic characteristics: − OBE - VI degree by МSК-64 scale with PGA of 0.05g for recurrence period of 100 years; and − DBE - VII degree by МSК-64 scale with PGA of 0.1g for recurrence period of 10000 years. The SFSF had been designed in the period from 1982 to 1984 with the following seismic characteristics: DBE = VII degree by МSК-64 with PGA of 0.1g for recurrence period of 10 000 years. The DSFSF had been designed and constructed after 1992 and its design incorporated the actual seismic characteristics of the site, as defined in 1992: − OBE Seismic Level 1 (SL1) with PGA of 0.10g for recurrence period of 100 years; − DBE Seismic Level 2 (SL2) with PGA of 0.20g for recurrence period of 10000 years. CURRENT SEISMIC DESIGN BASIS Current seismic characteristics of the Kozloduy NPP site were defined in the period 19901992 and are valid for all facilities located on the site. REASSESSMENT OF SEISMIC DESIGN BASIS In the period 1990-1992, under a joint IAEA project BUL 9/012 “Site and Seismic Safety of Kozloduy and Belene NPPs”, new site seismic characteristics were defined. Seismic levels for recurrence period of 100 and 10000 years respectively were determined using probabilistic and deterministic methods. Thus, for Kozloduy NPP site were defined: − For recurrence period of 100 years - PGA of 0.10g; 13 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T − For recurrence period of 10000 years - PGA of 0.20g; and − Resultant floor design response spectra and respective three-component accelerograms for duration of 61s. Following an IAEA recommendation, a floor design response spectra and respective threecomponent accelerograms (for duration of 20 s) were additionally defined for local earthquakes. The seismic characteristics – seismic levels, resultant design floor response spectra and respective three-component accelerograms were reviewed and confirmed by IAEA experts in the period from 1992 till 2008. The so called Review Level Earthquake (RLE) was also defined. This is the level, for which all SSCs of 1st seismic category of plants already designed and commissioned should be reviewed in respect of seismic resistance. METHODOLOGY FOR REASSESSMENT OF SEISMIC DESIGN BASIS The reassessment of site seismic characteristics performed in the period 1990-1994, under an IAEA project BUL, followed the existing at that time IAEA documents, namely: − Safety Series No.50-SG-S1 (rev.1) “Earthquake and associated topics in relation to nuclear power plant siting”; − Safety Series No.50-SG-D15 “Seismic Design and Qualification for NPPs”. The two standard levels of peak ground acceleration with recurrence periods respectively 100 (SL1) and 10000 years (SL2) are determined based on tectonic, geological, geomorphologic, seismic and geophysical data using probabilistic and deterministic methods. The RLE is defined by application of the rules for defining SL2. The methodology for probabilistic analysis of the seismic hazard is based on standardized mathematical model of Cornel and the software of McGuire 1976 and Toro and McGuire 1988. Results summary highlighted the following main conclusions: − in the investigated area there are no large faults with high energy potential (there is no data of existence of a capable fault). − Kozloduy NPP site is located in the relatively most stable part of the Moesian platform. This conclusion is confirmed also by the data, accumulated in the existing already for 14 years database of the local seismic monitoring network located around the site. The earthquake database, which was used, covers the period from 375 till 1990. The catalogue contains 812 independent seismic events with defined МSК-64 intensity. Uncertainties in the seismic input data were studied and considered through the so called logical tree (logic diagram). 24 seismic hazard curves were defined. The characteristics of the design seismic impact were defined as well – design floor response spectra and respective three-component accelerogram, taking into account site geological conditions. ASSESSMENT OF THE ADEQUACY OF THE REASSESSED SITE SEISMIC DESIGN BASES All aspects and stages of seismic characteristics reassessment were discussed by multiple international missions involving IAEA experts and leading specialists in this area from Bulgaria, Macedonia and Romania. The seismic input databank was adopted and validated by the followup international activities and international expert missions. 14 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T COMPLIANCE WITH APPLICABLE LEGISLATIVE DOCUMENTS AND STANDARDS Reassessment of site seismic characteristics had been performed mainly based on the IAEA Safety Standard. Using comparative analysis it was confirmed that site seismic characteristics, as reassessed in 1992, together with the additional studies of 1995 meet the requirements of both current documents: the IAEA Safety Standards Series No. SSG-9 “Seismic Hazards in Site Evaluation for Nuclear Installations”, 2010; and the Regulation on Ensuring the Safety of NPPs of 2004, namely: − the site shall not be located directly over a capable fault; − peak ground acceleration during an earthquake with recurrence period of 10000 years shall be less than 0.4g. CONCLUSION ON THE ADEQUACY OF THE CURRENT DESIGN BASES Kozloduy NPP site seismic characteristics, reassessed in 1992, together with the additional studies of local earthquakes and the probabilistic definition of seismic impact performed in 1995 meet the requirements of existing legislation, namely: − in the investigated area of the Kozloduy NPP site, there are no large faults with high energy potential (no evidence of a capable fault); − Kozloduy NPP site PGA is defined for an impact with recurrence period of 10000 years and PGA is 0.2g. PROTECTIVE MEASURES AGAINST RLE AT UNITS 3 AND 4 SSCS REQUIRED TO MAINTAIN THE FSP 3 AND 4 IN SAFE CONDITIONS Equipment actual state and operability have been determined on the bases of a review of seismic qualification of the elements (components) and the method for seismic qualification of seismic category 1 SSCs. Following the implementation at Units 3 and 4 of the Short-term Programme and the Comprehensive Modernization Programme, all safety related design and operation deficiencies have been eliminated and the facilities comply with the current safety standards and the international practice. Seismic categorization of the individual elements of the main buildings had been completed with consideration of related factors and the results of modifications and improvements of the original design V230. Reinforcement of reactor buildings was implemented in 2001, which significantly improved structures reliability. The seismic qualification of major civil structures of seismic category 1 and seismic category 2 was confirmed. The initial deign classification of Units 3 and 4 systems had been carried out on the bases of the existing at that time Regulation No. 3 on Ensuring the Safety of NPPs at Design, Construction and Operation (1988) and the Russian Requirements on Ensuring the Safety of NPPs at Design, Construction and Operation OPB-82. Later on, systems and components have been classified in accordance with the current legislation. Qualification procedure compliance with the international requirements is verified. Systems and equipment have been re-qualified as follows: − Safety classification was performed according to IAEA 50-SG-012: Periodic Safety Review of Operational Nuclear Power Plants, A Safety Guide, 1994 as the fundamental document, and other IAEA documents were used as supplementary; − Seismic classification was performed based on the IAEA Guide NS-G-1.6 Seismic Design and Qualification for Nuclear Power Plants Safety Guide, while the 15 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T requirements of Russian PNAE G-5-006-87 Norms for design of seismically resistant NPPs were also considered. The qualification was performed for the components included in the Safe Shutdown Equipment List (SSEL) and those needed for the safe storage of Spent Fuel (SF) in the Spent Fuel Pool (SFP). Seismic qualification and operability of the equipment ensuring the safe storage of SF in the SFP has been confirmed. . KEY OPERATIONAL MEASURES TO MAINTAIN SFP 3 AND 4 IN A SAFE STATE FOLLOWING AN EARTHQUAKE According to the updated Safety Analysis Report (SAR) of 2004, measures have been planned and implemented at Units 3 and 4, which ensure the required protection against seismic impacts and fires. Additionally, to ensure the safe and reliable storage of SF in the SFP, seismic qualification of the systems ensuring SFP operations was carried out. With respect of the requirements of the Regulation on the SF Management, the updated analysis of postulated initiating events for shut down state confirm: compliance with the criteria at different water density, as well as sufficient redundancy in SFP cooldown and filling systems. The SFP civil structure is capable to perform design functions and possess the required robustness and carrying capacity at different load combinations, including in emergencies thermal and seismic impacts at DBE. Robustness of SFP racks at different modes has been confirmed as well. Procedures have been developed, which specify personnel actions in reaching of the SFP storage safety limits and for implementation of measures only by using of specific programmes (to be agreed by BNRA). Following the Fukushima Dai-ichi accident, events in, a set of technical and organizational measures was developed, aimed at a comprehensive review and assessment of the current status of safety related equipment. Special attention was given to Beyond Design Basis Accidents (BDBA) and adverse external and internal impacts to the storage of spent fuel in the SFP. The following measures have been developed and implemented: − a list of BDBA scenarios for Units 3 and 4 was developed; − a BDBA scenarios training programme was prepared for the operating personnel of Units 3 and 4. EVALUATION OF THE INDIRECT IMPACT OF THE EARTHQUAKE Assessment of potential failures of SSCs - not qualified seismically Analyses of the conditions of the ventilation reinforced concrete chimney of Auxiliary Building 2 (AB-2) demonstrate proper robustness. According to the analysis (REL-880-FR-010), it was concluded that if during RLE seismic impact, one third of the ventilation chimney length (50 m from the top) fall down, the debris will fall over the AB (south-east part) and the radioactive contamination could complicate the access of the personnel to some areas, for example the building of the Additional SG Emergency Feedwater System (AEFWS). Potential loss of off-site power In Loss Of Off-site Power (LOOP), backup power supply to SFP cooldown pumps is ensured by the AEFWS sections (additionally to the power supply from the diesel generators). A conservative scenario involving an earthquake and parallel accidental conditions at other nuclear facilities on-site, the use of a Mobile Diesel Generator (MDG) in two different places 16 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T will be required. Respectively, it becomes obvious that availability of at least two MDGs is needed. Loss of ultimate heat sink According to the safety analysis, there is a possibility to connect additional alternative systems to fill up and cooldown the SFP. These systems could provide sufficiently large flowrate in order to maintaining the SFP level till the elimination of the leakage or the transfer of the fuel into the reactor core. The AEFWS is involved in the scenario with loss of Ultimate Heat Sink (UHS). In case of loss of Bank Pumping Station (BPS) and the standard systems (primary and secondary circuits) remaining operational, to cooldown SGs, the water inventories enclosed in between the fore chamber of Central Pumping Station 2 (CPS-2), the fore chamber CPS-1, and the underwater barrier (at curve 8), which prevents cooling water flow back to the BPS are used. The service water system for essential consumers ensures supply of cooling water to the heat exchangers for SFP cooling. System back-up is provided by the Fire Extinguishing System 2 (FES), through two collectors cut into the service water surge lines. An emergency pumping station was built in close proximity to BPS-2 and BPS-3. The emergency pump station ensures independent water supply from the fore chamber of BPS-2 and BPS-3 to the cold channel. If due to any reason, the operability of the spray ponds is lost, the AEFWS-3,4 systems are to be used for cooling of the nuclear facilities. The AEFWS-3,4 tanks are provided with backup supply of water by both the FES and the artesian wells on-site. SEISMIC PROTECTIVE MEASURES FOR RLE AT UNITS 5 AND 6 SSCS REQUIRED TO PUT INTO AND MAINTAIN UNITS 5 AND 6 IN SAFE SHUTDOWN STATE Based on the existing plant SSEL, the SSCs required for plant shutdown and maintaining it in safe condition and which should remain available during and after an earthquake have been identified. The analyses focused mainly on the reactor installation at power and in particular on the limits ensuring the integrity of the second protective barrier – fuel elements cladding. The SFP stress tests cover the respective structures at manipulation of SNF (the most adverse operational states allowed by the technical specifications) with the same objective – to preserve the integrity of fuel elements cladding. Within the Modernization Programme, the seismic resistance of all safety related buildings and structures was reviewed in respect of site specific impacts. The seismic qualification of main structures of seismic category 1 was confirmed. Seismic qualification of safety related equipment as well as verification of compliance with international standards were performed as part of the Modernization Programme. Equipment qualification status was verified and lists of the equipment required for the safe shutdown of the units were developed: − SSSL (Safe Shutdown Systems List); − SSEL (Safe Shutdown Equipment List); − HECL – Harsh Environment Component List. 17 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Following the analysis of the current qualification status of the equipment, these lists were reconsidered and updated, as part of a contract between Kozloduy NPP and VNIAES – Moscow. Recently, seismic qualification of the remaining not qualified equipment is being carried out. The process of plant seismic qualification continues in a systematic way, including during supply of new equipment, maintenance and improvements. Lists of the qualified equipment are kept upto-date (Safety Shutdown Equipment List). Safety Systems Initial design classification of the systems had been performed according to the Regulation No. 3 on Ensuring the Safety of NPPs at Design, Construction and Operation (1988), which is similar to the Russian Requirements on Ensuring the Safety of NPPs at Design, Construction and Operation OPB-82. In the framework of the Modernization Programme of Units 5 and 6 (and in accordance with the IAEA regulations), classification of systems and components in terms of safety, seismic resistance and quality was performed according to the legislation in force. The safety classification was performed using OPB-88/97 and PNAE G-01-011-97, as the main documents and using the functions from IAEA Safety Series No. 50-SG-D1: Safety Functions and Component Classification for BWR, PWR and PTR. The seismic classification was performed based on the IAEA Guide: Safety Series NS-G-1.6 Seismic Design and Qualification for Nuclear Power Plants, 2003 with due consideration of Russian PNAE G-5-00687 Norms for design of seismically resistant NPPs. Reactor Classification of systems and components was performed within the framework of the Modernization Programme. Reactor and reactor internals were originally designed for seismic impact of 9 degrees by MSK-64 (PGA= 0,4g). These requirements were specified in the Terms of Reference and were confirmed. Reactor modernization activities are summarized in the Updated SAR. Reactor building main equipment Reactor building main equipment was designed for 9 degree by MSK-64 (PGA= 0,4g. Modernization activities in respect of the primary circuit and related systems are described in the Updated SAR. Programme analysis were performed, seismic resistance of main equipment and safety systems equipment was calculated, and proposals for needed reinforcements were developed. The seismic qualification of primary pipelines, equipment and fixing elements was verified by the measures of the Modernization Programme with the results are summarized considering the new seismic requirements and results were summarized with consideration of the new seismic requirements for the site. Equipment of the emergency power supply systems Power consumers are divided into 3 categories, depending on electricity type and the reliability of their power supply. Consumers of category I are AC and DC users, for which in any mode, loss of power supply for more than a half period - 20 ms is not acceptable. Consumers of category II are also AC and DC users, but for them the allowed loss of power supply is 1 min (time of DGs start-up and automatic consumers loading). Consumers of category III are powered up by the normal operation systems. 18 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Robustness against loss of power supply (during an earthquake) is ensured by the following design features: − any safety system is provided with 2 (for category II) or 3 (for category I) independent power supply sources, namely: house loads transformers; DGs; and accumulator batteries; − each unit is provided with four DGs (3 by the original design and 1 installed during the Modernization Programme), all located in separate rooms; − availability of passive devices, which assist the most important safety systems to fulfil assigned functions in station blackout, such as: gravity driven actuation of the reactor protection system; hydro-accumulators; safety valves; etc. All the equipment is seismically qualified for seismic category 1. Fuel storage, refuelling and transportation system Systems are seismically qualified with assigned seismic category 1. Support systems, working with water Systems are seismically qualified with assigned seismic category 1. Main steam lines system from SG to main steam isolation valve Analyses of possible rupture locations of main steam and feedwater lines, as well as of brakes effects were performed, as part of the Modernization Programme. Following that, limiting supports and protective devices against the line breaks effects were designed and installed. Reactor Protection System The two physically separated sets are seismically qualified - seismic category 1. MCR and ECR boards The metal structures of MCR and ECR boards and panels are seismically qualified for category 1. The Instrumentation and Control (I&C) equipment is seismically qualified. I&C equipment Safety systems I&C equipment is operable in all operational modes of the unit, including loss of house loads power supply. The systems are seismically qualified as seismic category 1. Neutron Flux Monitoring Equipment (NFME) The hardware of the neutron flux monitoring equipment, as well as equipment of the reactor protection system withstand a DBE seismic impact - 8 degree by MSK-64 at the elevations + 24,6 m, + 13,2 m, minus 4,2 m – category I. Equipment of automatic power controller and power limiting controller is qualified for category II. The NFME is in conformity with Russian regulations NP-031-01 Norms for design of seismically resistant NPPs, Moscow, 2001. MAIN OPERATIONAL MEASURES TO PUT INTO AND MAINTAIN SHUTDOWN STATE UNITS 5 AND 6 IN SAFE As the results of the performed review, the following main operational and emergency measures were established to prevent core or SNF damage following an earthquake: − seismic monitoring and control system was installed and personnel action plan for and after an earthquake was developed; 19 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T − communication and coordination system of Kozloduy NPP and the national emergency services was established in respect of the on-site emergency plan. On-site response activities were incorporated in the National Emergency Plan; − personnel action plan for and after an earthquake was developed and is in use; − Emergency Procedure on Plant Shift Supervisor Actions at an Earthquake was developed and is in use; − Symptom-Based Emergency Operating Procedure (SBEOP) for an earthquake was developed and is in use; − mobile equipment was supplied. A mobile diesel generator is provided. Mobile diesel pumps for water pump out in emergencies were recommended; − Unit 5 and 6 equipment surveillance programme was developed and is being followed; − equipment physical and functional tests are being performed. The activities on review of SSCs technical condition are planned to ensure prevention before real failures occur with the objective to reduce failure probability; − periodic inspections and tests of SSCs are properly recorded; − automatic actions are provided – earthquake automatic reactor scram system was installed; − an automated plant information systems was established, which is conducting continuous radiation monitoring within the 3km zone around the site. The system is integrated with the similar national system; − other measures to prevent, recover from and mitigate accident consequences. Following the accident at Fukushima Dai-ichi NPP, a work programme was developed to review and assess Kozloduy NPP preparedness for beyond design basis accidents, external and internal events and for mitigation of their consequences. The results of programme work already done are summarized and analysed. According to the analyses, the number of portable submersible pumps should be optimized, in respect of better response to internal flooding (measure B-2-3). Additional measures were proposed for improvement of protection from external and internal impacts. Measures that were not implemented are included in the table Annex 1 to this report. Actions have been taken for development and updating of the emergency procedures for Open Switchyard (OSY) personnel (in departments, where needed) in case of an earthquake, flooding, fire and explosion. Emergency teams capabilities to apply the emergency plan and the respective procedures were practically tested during earthquake and flooding exercises and drills. Responsible persons from the Accident management Team are familiar with the procedures and follow them properly. ASSESSMENT OF INDIRECT EFFECTS FROM THE EARTHQUAKE Assessment of potential failures of SSCs not seismically qualified In the review, plant common systems, which are not seismically qualified but are important for coping with the secondary post-earthquake effects are identified and analyzed. Measures taken to preserve their functionality during and after the earthquake are reviewed. Measures are provided to ensure that damages of components of lower seismic qualification will not lead to failure of SSCs, which are required for the safe shutdown of the installation and maintaining it in a safe shutdown state. 20 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Within the framework of the Modernization Programme, the following measures to prevent seismically induced interactions were analyzed and implemented: − ensuring free seismically induced movement of the cableways; − turbine hall reinforcement; − reinforcement of turbine hall structural elements located over the cable ducts; − installation of constraints at the steam lines to prevent damage to closely located equipment of the safety systems. Potential loss of off-site power Following analyses of possible scenarios, the following accident states were defined, which could result from a RLE seismic impact or lower. • Total loss of AC power SGs makeup from diverse systems in case of total loss of AC power was provided and system functional tests were performed. The system is capable to provide makeup to the steam generators in initiating events with total loss of electric power supply of categories II and III, as well as in case of unavailability of SG emergency makeup pumps. The system operates independently from the unit standard systems and uses only partially the piping of one train of the SG emergency makeup system. • Loss of OSY As the OSY is not qualified as seismic category 1, it is likely to be lost at a seismic impact lower than RLE. Moreover, the national electric grid is seismically designed by industrial standards for impacts lower than RLE and OBE. Thus, even at earthquakes lower than RLE, permanent loss of off-site power is possible due to failures and damages in the national power generation system and the national grid. The logic diagrams of generator voltage are installed by “generator – transformer" unit logic. Connection between units is provided at the side of 400kV of unit transformers. Circuit breakers are installed to improve reliability. Auxiliary transformers are connected in-between the circuit breakers and unit transformers. Thus, house loads users could be supplied with power from the auxiliary transformers with the generators being switched off. Connections between the elements of the unit Main Circuit Diagram and the auxiliary transformers nodes are made using phase-by-phase capsulated busses 24kV. In auxiliary transformers, there is no switch-over equipment resulting in enhanced reliability. To increase reliability and reduce the likelihood of total loss of power supply to OSY 400 kV, the switchyard is designed as double sectioned bus bar system. To improve units reliability, the principle of connection to the 400 kV side by circuit diagram of “two circuit breakers for connection” was adopted. • Loss of power supply to safety systems Three accumulator batteries are available - one for each of the safety system trains. The batteries operate in continuous charging mode and their charging is provided by rectifiers, which are part of the Uninterruptible Power Supply (UPS) system. By tests it was identified that batteries last over 10 hours under real load. • Loss of category II emergency power supply Fuel and oil reserves, required for continuous operation of the emergency category II power supply sources are ensured, as follows: 21 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T − DG stations 5 and 6: total operational fuel inventory ensures continuous operation of each DG for at least 3 days; − Additional DGs 5 and 6: operation for 70 hours is ensured; − Diesel pumps at CPS-3,4: 24 hours’ operation of all pumps (8) simultaneously; − DG “Emergency preparedness”: 8 hours of continuous operation at nominal load without refuelling. Loss of ultimate heat sink The principles of redundancy, physical separation and independence of the trains are applied in the design of the Essential Components Service Water System (ECSWS). No specific measures are applied in the design of Non-Essential Components Service Water System to ensure the supply of cooling water. In case of loss of ECSWS, reactor fuel cooling could be provided by use of the AEFWS, and cooling of the fuel in the SFP could be provided by the SFP make-up systems. Six spray pools are built at Units 5 and 6. System trains operate by a closed circuit with water cooling in the spray pools. Each spray pool is designed to remove the total amount of heat, which is generated by the unit in accident conditions. Normal and emergency makeup of the spray pools is provided. Pools makeup is provided by normal electric pumps and in the case of loss of off-sire power by diesel pumps. The pumps are located in CPS 3 and 4. Pools emergency makeup is provided by 6 Shaft Pump Station (ShPS), located in the Danube River Valley. The Shaft Pump Stations receive power supply from the BPS through cable-overhead lines 6kV from the section V - 6kV of BPS and section IX - 6kV of the “Reliable power supply”. A procedure for temporary power supply of ShPS by the BPS DG was developed. Other indirect impacts caused by fires or explosions • Seismically induced internal floods – at the site or inside the buildings Existing analyses of internal flooding hazards, as well as seismic qualification status of the pipelines on-site and inside the buildings were assessed. Measures are provided to prevent adverse internal flooding effects on plant safety resulting from ruptures of non-seismically qualified pipelines on-site or inside the buildings. • Analyses internal flooding consequences Under the Modernization Programme, analyses of the consequences from internal flooding were performed. Individual analyses were developed for flooded compartments, for all respective fluid systems, located inside the reactor building, outside the containment, and in the turbine hall. The study was performed for Unit 6 and respective differences of Unit 5 were considered. Conclusions are made for each separate compartment, depending on flooding impact on safety systems equipment and on civil structures. • Measures to cope with fires The fire extinguishing system is composed of sub-systems and constructed in accordance with the following requirements: − to reduce fire hazard; − to ensure physical separation of the systems required to achieve safety targets. • Protective measures against explosions 22 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T The analysis performed included safety assessment of the impact of the petrol station owned by Kozloduy NPP and located on the territory of Auto park 2. A new requirement was specified: the total amount of fuel inventory in the petrol station shall not exceed 3 tons. Impacts of a potential explosion of the petrol station fuel inventory on neighbouring on-site facilities and structures were reviewed and assessed. The results demonstrated that no components of the safety systems will be affected. PROVISIONS MADE FOR SFSF PROTECTION AGAINST RLE SSCS REQUIRED FOR MAINTAINING SFSF IN A SAFE STATE Analyses are performed on the bases of the available Kozloduy NPP documents and the results of respective studies and reviews. The review is based mainly on SFSF SAR, SFSF Technical Specifications, and the SAR of Unit 3. Analyses cover all operational states, taking into account the most unfavourable conditions (operational boundary conditions). SSCs lists were developed to cope with different accident scenarios. The SFSF civil structure was designed in the period 1982-1984 according to specifications of the Russian side (as general designer) and using the applicable legislation, which had been in force at that time. Following the reassessment of site seismic characteristics, a project on civil structure reinforcement had been implemented, which properly considered the new seismic levels. After the seismic reinforcement on the main support structure, it could withstand all combinations of DBE seismic impact and operational loads. Additionally, combinations cove permanent, useful, and temporary loads plus thermal impact in anticipated operational occurrences or dynamic loads from fuel channel head falling into the pool. MAINTAINING THE SFSF IN A SAFE STATE FOLLOWING AN EARTHQUAKE In the period 1994-2000, a series of projects and technical modifications were developed and implemented with the objective to improve SFSF safety. They covered seismic qualification and seismic reinforcement of buildings, equipment and components. Main structure was seismically reinforced and qualified. Railways were strengthened. Equipment, valves and piping of the safety important systems and SFSF technological equipment (involved in fulfilment of safety functions) were qualified. Level sensors (alarms) located in the -7.20m elevation compartments were included in the SSCs flooding lists (for accident management and mitigation of consequences in case of a beyond design basis accidents in SFSF, internal and external events). In this respect, due to lack of a referent qualification document, their seismic qualification status shall be confirmed. ASSESSMENT OF EARTHQUAKE INDIRECT EFFECTS Assessment of potential failures of SSCs, not seismically qualified SFSF Building is located on-site, southern from Auxiliary Building 2 (AB-2). AB-2 ventilation stack (chimney) is situated at 36 m from the SFSF north-east corner. The ventilation stack possesses the required seismic resistance and in case of RLE no damage to SSCs (SFSF building, emergency DG building) or hindered access to them are expected. 23 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Potential loss of off-site power Loss of off-site power supply shall “a’priori” be considered in the DBE accident analysis. SSCs (SFSF emergency DG and plant mobile DG) are provided to ensure power supply to SFSF consumers from independent sources of category I and II power supply. To ensure reliable functioning of the systems in case of loss of off-site power, the required inventories of fuel and oil are maintained at the SFSF. Other indirect impacts, caused by fires or explosions Active and passive measures have been taken to ensure, to the extent possible, the SFSF fire safety: − passive measures – the main civil structures are built out of reinforced concrete, the roof is constructed with fire-preventing beams (zones) made out of non-combustible materials installed at every 6m. − active measures – they include: external fire protection ring; internal fire fighting installation (compartments equipped with fire taps and dry tubing for water fire extinguishing on the roof). Fulfilment of fire safety requirements guarantee SFSF safety in case of fire. Possible explosions at receiver sites were reviewed. Possible events defined do not endanger the SFSF safe operation. MEASURES TO PROTECT DSFSF SEISMIC DESIGN BASES SSCS REQUIRED TO MAINTAIN DSFSF IN A SAFE STATE The analyses are performed in respect of DSFSF technical design, approved by the BNRA. The Interim SAR was mostly as a source of input information. All storage safety functions are maintained in a passive way, as there is no need of active safety systems. All DSFSF SSCs are classified considering their safety functions and in accordance with the referent documents. DSFSF building, 145 t crane, containers CONSTOR® 440/84, shielding doors and doors operational alarms are of seismic category – Design class 3. DSFSF building could withstand SL1 and SL2 earthquake without a catastrophic damage. The crane is designed for SL1 and SL2 earthquake with no destruction of the structures or load falling. Improper operation of the crane, electric and measuring components do not lead to dangerous conditions. CONSTOR® 440/84 containers are designed not to roll-over in DBE. DSFSF design complies with the requirements of the Regulation on Ensuring the Safe Management of SF and respectively defence-in-depth principle is applied. DSFSF seismic design basis Two design earthquakes are defined, namely: − SL1 with occurrence 1 E-02 /year (PGA 0,1 g); − SL2 with occurrence 1 E-04 /year (PGA 0,2 g). Analyses have been performed of all normal and specific loads and load combinations thereof, according to the applicable European standards and IAEA TECDOC 1347: 24 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Consideration of external events in the design of nuclear facilities other than nuclear power plants, with emphasis on earthquakes. Similar to the building, the crane was also reviewed in respect of the following adverse combinations of load conditions: − OBE (SL1 - 0,1 g) with operating crane 145 t − DBE (SL2 - 0,2 g) with standby crane 145 t. Both, the building and the crane are designed for OBE and DBE without damage to the structures or load falling. Containers stability against roll-over was confirmed for seismic loads for OBE (SL1 - 0,1 g) and DBE (SL2 - 0,2 g). MAINTAINING THE DSFSF IN A SAFE STATE FOLLOWING AN EARTHQUAKE DSFSF has installed a fire alarm system ensuring local warning and warning in the continuously operating control centre, which notify the on-site fire fighting services. Proper access to DSFSF and the corridor between DSFSF and SFSF is ensured for fire fighting vehicles. ASSESSMENT OF EARTHQUAKE INDIRECT EFFECTS On-site facilities that may impact the DSFSF after a seismic event are SFSF and AB-2 chimney. As a result of the analyses performed, various strengthening activities were done (additional steel joints, frames and supports, as well as the construction of new monolith concrete walls). AB-2 chimney was analyzed against the new site seismic characteristics. It is important to note that even in stack damage scenario, the chimney will not impact the DSFSF, because of its distance from the building. The conclusion is that the DSFSF will not be affected by other on-site facilities following an earthquake. Assessment of potential failures to SSCs, not seismically qualified Potential failures of SSCs, which are not seismically qualified were assessed and which by mechanical impact or through internal flooding could compromise the safe and stable state of the containers. This scenario assesses the consequences to a container, which is overwhelm with debris. This could result from extreme external initiating events, such as an earthquake, gas explosion or airplane crash. Calculations using conservative assumptions show that for 100% debris overwhelming, the maximum cladding temperature may be exceeded after more than 2 or 3 days. Considering roof structure, the expected realistic degree of overwhelm is below 50%. This increases the available time to implement countermeasures to more than 7 days. Even for the worst scenario of loss of heat removal, there is sufficient time available to take adequate countermeasures, i.e. to remove the debris and restore natural ventilation. Potential LOOP The total blackout scenario is not relevant for the DSFSF, due to the availability of a passive system for decay heat removal. 25 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Other indirect impacts, caused by fires, explosions, flooding As an initiating design basis event, the earthquake may cause a fire with a thermal impact on the containers. To avoid fire negative effects on safety the following provisions are made: − minimization of fire ignition sources and of fire loads; − fire detection system is provided at the DSFSF building; − fire resistant design of the containers (containers are designed to withstand the boundary severe fire accident of constant 600 ° C temperature for 1 hour, for which time the fuel cladding temperature is maintained below 330° C). DSFSF building and containers design analyses include a scenario with an on-site explosion or an explosion of a vehicle passing by the DSFSF. Internal explosions could be excluded, since there are no explosive materials inside the facility. The DSFSF building storage hall is designed to withstand the pressure wave from a gas cloud explosion. However, the fall down of debris from the roof structure (thin metal plates) into the storage hall could not be excluded. POTENTIAL OFF-SITE IMPACTS To assess possible adverse effects, of seismically induced damage to the national infrastructure around the plant, on its ability to maintain safety functions it is necessary to investigate when and what seismic failures and damages could be expected. Possible adverse impacts on the plant are mainly limited to: − loss of off-site power; − destruction of roads and bridges; − large demolitions in the nearest settlements, which could lead to impossibility of gathering plant operating staff, etc. Additional analyzes of the behaviour of site vicinity infrastructure under seismic event, as well as safety impacts are being carried out. ASSESSMENT OF SAFETY MARGINS AGAINST EARTHQUAKE For the purpose of reassessment of safety margins, review of safety functions parameters and the conditional probabilities (fragility curves) for destruction of individual SSCs was conducted. The objective of seismic vulnerability analyses is to determine acceleration values at which the seismically induced conditions at the respective component (located at a definite point of the structure) will exceed its capacity. The analysis consists of sequential review of all ranges of seismic impacts and safety related SSCs that fail are determined for each particular range. Changes in facilities performance (changes in the progression of accidental sequences) and changes in fulfilment of safety functions are identified. This approach allows, in a systematic way, the fulfilment of the main objective of the safety reassessment, namely to define the limiting values of the accelerations, which the unit could withstand without a significant fuel damage or environmental release of radioactive substances. EVALUATION OF UNITS 3 AND 4 SAFETY MARGINS AGAINST EARTHQUAKE According to the final report of earthquake analyses, Units 3 and 4 margin is 0,16g or 80% of RLE (PGA=0,2g), i.e. the units could withstand (without fuel damage) an earthquake 1,8 times greater than the DBE, valid as of 30.06.2011. 26 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Assessment of the seismic impact leading to severe fuel damage Based on the analyses, conclusion could be made that the fuel damage could not be prevented at PGA over 0,36g, i.e. at acceleration where liquefaction of sands under fire protection station-2 and CPS-2 is anticipated. Till this impact level, the unit ensures reliable fuel cooling in the SFP (or the reactor). Partial fuel assemblies untightness is possible in the upper range 0,26 295 h (12.3 days) 4 Loss of primary circuit cooling due to failure of emergency and planned cooldown system at pressurized primary circuit and non-drained SGs (Considered: make-up of SG with SG EMS and using one auxiliary make-up pump from demineralized water tanks) > 298 h (12.4 days) 5 Loss of primary circuit cooling due to failure of emergency and planned cooldown system at depressurized primary circuit (Considered: injection of the three ECCS hydro accumulators) > 204 h (8.5 days) 6 Loss of primary circuit cooling due to failure of > 206÷209 h 57 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Initiating event Option Time to fuel damage emergency and planned cooldown system during the mode (8.6 days) of outage cooldown of the primary circuit (Considered: injection of the three ECCS hydro accumulators) Rupture of the connections between the spray pools and nuclear power Units 5 and 6 1 Loss of vacuum in the turbine condenser > 99 h 30 min (Considered: make-up of SG with SG EMS and using one (4.2 days) auxiliary make-up pump from demineralized water tanks) 2 Complete loss of make-up water to the SG (Considered: make-up of SG with SG EMS) 27÷31 h 3 Loss of primary circuit cooling due to failure of emergency and planned cooldown system at pressurized primary circuit and drained SGs (Considered: make-up of SG with SG EMS and using one auxiliary make-up pump from demineralized water tanks) 97:50 h (> 4 days) 4 Loss of primary circuit cooling due to failure of emergency and planned cooldown system at pressurized primary circuit and non-drained SGs (Considered: make-up of SGs by SG EMS and using one auxiliary make-up pump from demineralized water tanks) 100:50 h (> 4.2 days) 5 Loss of primary circuit cooling due to failure of emergency and planned cooldown system at depressurized primary circuit (Considered: injection of the three ECCS hydro accumulators and use of the inventory of the boron control system tank) 19:45 h 6 Loss of primary circuit cooling due to failure of emergency and planned cooldown system during the mode of outage cooldown of the primary circuit (Considered: injection of the three ECCS hydro accumulators and use of the inventory of the boron control system tank) 3 days after shutdown 25:51 h 18 days after shutdown 50:12 Loss of ultimate heat sink, in combination with station blackout Simultaneous loss of power supply and ultimate heat sink is considered as: − Loss of off-site power and loss of all on-site stationary AC sources (emergency and additional DGs); − Loss of main ultimate heat sink, defined as loss of Danube River water intake facilities. Following the postulated external initiating event, loss of operability is assumed for: − Open switchyards; − Emergency DGs; − Additional DGs; 58 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T − Bank pumping stations and their structures, including DGs; − Shaft pumping stations. For accident management, the following could be used: − Mobile DGs and the facilities supplied by them; − Emergency water inventory in the cold channel; − Pumps with own diesel motor, including fire-protection pumps; − Consumers of Category І power supply till the discharge of accumulator batteries (10h and 18 min). − Manually-operated valves; − Other equipment, not affected by the initiating event. • Time of site self-dependence before fuel damage due to loss of primary water Units 5 and 6 response at different operational states is presented below. Table 2.6. Time to fuel damage at initiating events with loss of power supply and loss of ultimate heat sink No. Unit initial conditions Assessment results 1. Power operations Event is reduced to scenario of loss of normal and backup power supply, failure of all emergency DGs and the additional DG. Time to core damage: 45 – 49 hours 2. Shut down reactor, planned cooldown at pressurized primary circuit and drained SGs Event is reduced to scenario of loss of normal and backup power supply, failure of all emergency DGs and the additional DG. Time to core damage: 66 hours 44 min 3. Shut down reactor, planned cooldown at pressurized primary circuit and non-drained SG Event is reduced to scenario of loss of normal and backup power supply, failure of all emergency DGs and the additional DG. Time to core damage: 69 hours 44 min 4. Shut down reactor, planned cooldown at depressurized primary circuit Event is reduced to scenario of loss of normal and backup power supply, failure of all emergency DGs and the additional DG. Time to core damage: 7 hours 28 min 5. Shut down reactor, outage cooldown Event is reduced to scenario of loss of normal and backup power supply, failure of all emergency DGs and the additional DG. Time to core damage: - 3 days after shutdown: 9 hours 15 min - 18 days after shutdown: 16 hours 53 min • External actions to prevent fuel damage Use of the mobile DG is included in the Emergency plan. 59 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T UNITS 5 AND 6 SFPS Loss of ultimate heat sink At failure of all trains of the SFP cooling system and in containment isolation, decay heat removal from the stored fuel is provided through evaporation of pool water. To prevent inadmissible reduction of water level in fuel sections and respectively prevent fuel outcrop, an emergency feeding alignment is applied by the use of one containment spray pump taking water from the ECCS sump tank. Pump motor is cooled by the essential components service water system. Facility response at loss of ultimate heat sink is the same, as at loss of power supply. However, in this case, heat removal is terminated at a much later stage – after emergency water inventory of the cold channel is exhausted and spray pools make-up is discontinued. Thus above mentioned available time (estimated for total blackout) is extended by 197 hours (8.2 days). A possibility exists, to supply service water by the use of diesel-pumps. This is done from the fore chamber of CPS-3 (CPS-4) to the first train of the essential components service water system. Arrangements are made to provide cooling of pump motors by the use of the first train of the emergency core cooling system. Thus, due to water inventory in the sump tank, SFP evaporation could be compensated for 32 h 15 min (considering the most severe conditions - fuel is unloaded from the reactor and put into the SFP). Using the boron solution reserve available in the boron control system tanks, time for which evaporation losses are compensated is extended by at least 19 hours. In this case, operation of the feeding does not depend on the operation of the service water system. UNITS 3 AND 4 SFPS Loss of ultimate heat sink • Design bases for heat removal to the main ultimate heat sink Removal of the decay heat from the SFP-3,4 spent fuel is provided by the SFP cooling systems. Heat is transferred through heat exchangers to the essential components service water system. After cooldown in the spray pools, the water is returned back to the cold channel. • Loss of main ultimate heat sink An alternative way for SFPs heat removal is the use as an ultimate heat sink the water in the fore chamber in-front of the CPS. Water is supplied to the SFP heat exchangers using dieselpumps, located in FPS-2. When impossible to remove the heat via the ordinary systems alignment, this could be provided by evaporation of water surface. To compensate for evaporation losses, two possibilities are provided: using the SFP feeding pump and water from the sump tank (Emergency Make-up Tank) or from other tanks and respectively using diesel-pumps of FPS-2 with water from the cold channel. There are many alternative ways for SFP heat removal (described in emergency procedures), for which independent power supply (electric or diesel motors) is ensured and 60 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T having diverse water sources. Thus, at loss of main ultimate heat sink, loss of the safety function “SFP residual heat removal” is not expected. • Loss of ultimate heat sink and loss of alternative heat sink At complete loss of all possibilities for cooling and filling up of the SFP-3,4, the times to occurrence of the main events and before outcrop of the fuel assemblies are the same, as those in the case of complete loss of AC sources. SPENT FUEL STORAGE FACILITY SFSF connection with the ultimate heat sink (Danube River) is provided by the service water system. SFSF is supplied with service water via two independent lines of the Units 3 and 4 systems. At complete loss of the main and the alternative heat sinks, due to the low intensity of decay heat, heat removal could be done by evaporation to ambient air. The impact caused by loss of all possible ways to compensate evaporation losses is the same as in the case of loss of power supply. However, the times to occurrence of the main events, as assessed for complete loss of AC power should be extended with the time for which the emergency water inventory of the CPS-2 fore chamber will decrease below the level of water intake by the pumps of the essential components service water system. An additional analysis was conducted for a beyond design basis accident with complete loss of SFP water due to beyond design basis earthquake, at which ground stability is affected and significant cracks open in the reinforced concrete of the SFP. Dry up of SF storage sections with the current SFSF load and simultaneous failure of all systems, combined with unavailability of natural ventilation will result in a significant increase in fuel elements temperature (up to 600°С) and of the civil structure temperature (up to 340°С), which is not acceptable in respect of safety limits for SF storage. Nevertheless, this will not result in fuel melt. MEASURES TO IMPROVE ROBUSTNESS AT LOSS OF ULTIMATE HEAT SINK − Conditions, efficiency and availability of emergency water supply from the Shishmanov Val dam should be carried out (Measure C-2-1). No measures to enhance SFP 3,4 robustness at loss of UHS are required. No measures to enhance SFSF robustness at loss of UHS are proposed. CONCLUSION A reassessment of the safety margins was performed in respect of events with loss of safety functions, which result in severe accidents. Reassessment covers: Units 5 and 6 reactors and spent fuel pools; Units 3 and 4 spent fuel pools; and the spent fuel storage facility. The reassessment is based on safety analysis performed using deterministic methods. Results of the analyses of postulated initiating events with loss of power supply and loss of ultimate heat sink show, in general, quite high robustness of the facilities, as well as availability of adequate time to undertake additional preventive actions, when needed. Following the regulatory review of licensee report on reassessment of safety margins, a conclusion is made that strengths and weaknesses have been properly identified. BNRA accepts the measures proposed for further improvement of plant robustness against the loss of power 61 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T supply and loss of ultimate heat sink. In addition, BNRA recommends that implementation of following design provisions shall be considered and analyzed: − Ensuring power supply using mobile DGs to: systems involved in residual heat removal of the reactor coolant boundary; and systems involved in primary circuit make-up in case of an open primary circuit; − Ensuring power supply using the accumulator batteries to the power operated motors of the valves installed at the hydro accumulators connecting pipes - in order to ensure feeding of the primary circuit in cold shutdown conditions and failure of the emergency DGs; − Ensuring power supply using mobile DGs or the additional DG to the systems providing SFPs cooling or feeding. 62 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T TOPIC 3 - MANAGEMENT OF SEVERE ACCIDENTS LICENSEE ARRANGEMENTS FOR ACCIDENT MANAGEMENT PERSONNEL AND MANAGEMENT OF SHIFTS IN NORMAL OPERATION Operational management of Kozloduy NPP facilities is performed by operating shifts 24 hours a day, 7 days a week. The personnel is distributed in 5 shifts and 2 more backup shifts are ensured. The senior shift manager is the Plant Shift Supervisor, respectively the Plant Shift Supervisor of Energy Production -1 (EP-1) - for Units 1-4 and Plant Shift Supervisor of Energy Production -2 (EP-2) - for Units 5-6. The Plant Shift Supervisor is responsible to ensure compliance with the statutory requirements for operation of the installations and for organization and implementation of prompt actions in case of emergency, natural disasters and for first aid. According to the instructions on Kozloduy NPP operational interactions in emergencies, the operational shift manager of a given unit performs the functions of emergency manager for that unit . Kozloduy NPP personnel is trained and instructed to report to the respective operational manager for any event which may lead to degradation of the safety of plant facilities. This is a prerequisite to timely assess and identify emergency situations, as well as to take appropriate actions. LICENSEE ARRANGEMENTS FOR ACCIDENT MANAGEMENT Activation of the Kozloduy NPP Emergency Plan establishes the emergency arrangements, which includes also some of the arrangements for normal operation. Responsible person for overall management of activities is the Emergency Manager. Until gathering of the emergency response team, the duties and responsibilities of Emergency Manager are performed by the Plant Shift Supervisor, as follows: − Plant Shift Supervisor (EP-1) - in case of emergency in Units 1-4 and plant common objects (Open switchyard, River bank pump station, Spent fuel storage facility); − Plant Shift Supervisor (EP-2) - for Units 5-6 and the Specialized Enterprise "Radioactive waste - Kozloduy". Emergency arrangements are organised in three levels according to the respective emergency situation: − level "I" - for class "ALERT"; − level "II" - for class "LOCAL EMERGENCY"; − level "III" – for classes "SITE EMERGENCY" or "GENERAL EMERGENCY". Emergency arrangements are based on a predefined and continuously maintained standby duty of the Kozloduy NPP full time personnel. It is regulated by a separate instruction, which provides easy formation of the respective emergency structures, depending on the location of the affected facility. The functional relationship between the emergency class, the composition of the response team and the location is specified by the Emergency plan. After activation of the Emergency plan, emergency teams personnel receive the status of "emergency personnel". The status of "emergency personnel" receives also the personnel of the support teams (maintenance and other personnel of Kozloduy NPP and personnel of external organizations) used for implementation of emergency activities. 63 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Particular personnel responsibilities and the order of their implementation are regulated by separate instructions and procedures. This documentation is distributed and is maintained on the working places, where emergency teams gather after activation of the Emergency plan. Staff actions in performing activities under the Emergency plan are regulated in separate plans, agreed and approved as required. A Management Group is gathered in all emergency situations, which reports directly to the Emergency Manager. Until the arrival and assembly of the Management Group, its functions are performed by the operating personnel on shift under the management of the respective Plant Shift Supervisor. Depending on the emergency situation, the members of the management group and the emergency personnel (operating and standby) are located at: − their work places: • main control room; • control room of the open switchyard; • control room of the river bank pump station − the Accident Management Centre (AMC). Plans for assistance to the site organization In case of physical isolation due to an external hazard (for example flooding), additional operational and maintenance personnel will be called up. A review of the Emergency plan is needed in order to consider all possible effects from a site physical isolation resulting from external hazards. Measures to ensure optimum personnel intervention The figure shows the Kozloduy NPP organization of the emergency response. The management group performs the following tasks: − gathers information about the conditions of affected facilities and of operating units; − manages the activities on accident evaluation; − takes decisions on: • personnel protection and accident management; • establishment of additional backup teams - if necessary; • shutdown or continuation of the operation of units not affected; • delivery of materials and spare parts for prompt repair and restoration activities; • request for assistance from the National Control and Coordination Headquarters (NCCHQ) and from the Ministry of Economy, Energy and Tourism; • initiation of restoration activities; • suspension of the Emergency Plan and restoration of the functional operability of affected facilities. − prepares and disseminates information to higher-level and local authorities. 64 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T OFF-SITE TECHNICAL ASSISTANCE FOR MANAGEMENT OF ACCIDENTS After activation of the Emergency plan, the Emergency Manager shall periodically inform about the accident progression and measures taken for accident localization and mitigation of consequences: − the emergency centre of the Nuclear Regulatory Agency; − the officer on duty at the Fire Safety and Public Protection Department (FSPPD) of the Ministry of Interior; − the officer on duty at the Ministry of Economy, Energy and Tourism; − the officers on duty at the Kozloduy and Mizia Municipalities; − the officers on duty at the communication and information centres in the cities of Vratsa and Montana. External forces and means, which shall be gathered to support Kozloduy NPP are determined in the National Emergency Plan for rescue and urgent recovery actions in case of disasters, accidents and catastrophes. At "site emergency" or "general emergency", the Emergency Manager coordinates joint emergency activities with the National Control and Coordination Headquarters and its formations involved to help Kozloduy NPP. Under the leadership of the Emergency Manager are performed the joint actions between the site groups and the additional personnel within the plant area and in the preventive actions zone. Non-affected facilities are maintained in safe conditions and accident consequences are mitigated the plant personnel following the instructions given by the NCCHQ, BNRA and MEET. The Emergency Manager, by the help of the Leader of the support group informs the managers of the external support teams about the accident progress providing the following data: − information about the radiation releases and the accident progress; − routes to and areas where tasks will be performed; − escort of the support teams to the predetermined points in the accident vicinity and orientation in the situation; − assistance by radiation monitoring specialists; − exchange of data to maintain continuous communication and management. The Emergency Manager maintains continuous contacts and obtains information from the evacuation committee of Kozloduy Municipality for the evacuation of the population, in accordance with the terms and in settlements, defined in the National Emergency Plan. The overall coordination of the activities for localization, rescue, protection and liquidation activities at beyond design basis or severe accidents in Kozloduy NPP is carried out by the NCCHQ Chair. On-site responsible is the Emergency Manager. The NCCHQ Chairman coordinates and manages the activities of the external teams and provided resources. The direct management of the external teams is carried out by their managers. PROCEDURES, TRAINING AND EXERCISES Personnel actions in design and beyond design basis accidents are defined in the instructions for personnel actions in emergencies. Personnel actions, provided in the instructions, shall ensure the safe state of the nuclear facilities. 65 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Personnel actions to identify Units 5 and 6 status, to restore or compensate degraded safety functions and to prevent core damage or mitigate the consequences are defined by SymptomBased Emergency Operating Procedures (SBEOP). Three sets of SBEOP instructions are provided for Units 5 and 6, as follows: − SBEOP for power operation; − SBEOP for shut down reactor with pressurized primary circuit; − SBEOP for shut down reactor with depressurized primary circuit. The SBEOP contain: − procedures for diagnose of the state; − procedures for optimal recovery; − procedures for restoring of critical safety functions; − procedures for accidents with damage of the barriers. According to SBEOPs, actions are initiated after reactor scram or actuation of the safety systems. The structure and the scope of the SBEOP cover all design bases accidents and a wide list of BDBA. SBEOPs for power operation and shut-down reactor (pressurized primary circuit) are in force and are distributed to the operator's workplaces. SBEOPs for shut-down reactor and depressurized primary circuit are being verified and validated. Following operators training, the procedures will be in force for Units 5 and 6 at the beginning of 2013. These procedures include also actions in case of accident conditions in the spent fuel pool in the "shut-down reactor" and "refuelling" modes. Units 5 and 6 staff training is performed on a full-scope simulator, which is being kept in conformity with the referent Unit 6, in accordance with the Regulatory requirements and the ANSI/ANS-3.5-1998 standards. Two types of training are being performed for the MCR operators - continuous and initial training required for the licensing. Severe Accident Management Guidelines (SAMGs) are developed for Units 5 and 6, which follow the SBEOP format. Criteria are specified for transition from SBEOP to severe accident management guidelines. Kozloduy NPP SAMGs are verified and will be subject of internal validation. After operators training, the guidelines will be in force for Units 5 and 6 in the end of 2012. SAMGs are developed on the basis of system analysis of the processes and phenomena during severe accidents. A training course is developed and MRC operators passed theoretical SAMGs education. In compliance with the operational licenses of Units 3 & 4, Emergency procedures have been developed and enforced in order to regulate activities of operating personnel to handle the emergency situations at spent fuel pools during the long term storage of the spent fuel. In compliance with the operational licenses of the Spent Fuel Storage Facility an Emergency Procedure has been developed and enforced in order to regulate activities of the personnel to cope with emergency situations at the Spent Fuel Storage Facility. For the needs of the emergency training are developed: − programs for training in emergency planning; − three-level training courses, first level - for common staff (staff not included in groups and teams as well as for external organizations), second level - for emergency personnel (detailed training on emergency procedures); third level - for emergency personnel on positions included in the Emergency plan - to train the emergency procedures, instructions, methodology, etc. 66 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Training is documented in accordance with the established in the Kozloduy NPP personnel qualification system. The training, the emergency drills and general emergency training exercises are conducted in accordance with a schedule, approved by the Executive Director and in compliance with a program, which is developed and approved in advance. Scenarios are developed for emergency training and used to perform training of emergency teams. The Kozloduy NPP objective of emergency training activities is to test and maintain staff preparedness to respond adequately to emergencies. POSSIBILITY TO USE THE EXISTING EQUIPMENT MEASURES THAT ENSURE THE USE OF MOBILE DEVICES The mobile diesel generator is one of the design modernization measures of Units 5 and 6 of Kozloduy NPP, designated to enhance safety and aims to ensure emergency power supply to the "reliable power supply busses" in case of loss of AC power. A procedure is prepared for transportation and connecting the mobile diesel generator to the busses in the premises of the emergency feed water pumps. The success criterion is: the time from the loss of AC power supply until the starting of the pump shall be no longer than 2 hours. Fulfilment of this criterion is confirmed by emergency trainings, provided that destruction of the infrastructure as result from external influences is not considered. The total stock of fuel and oil for the mobile diesel generator ensures its continuous nominal power operation for a period of more than 21 hours and 40 minutes. For power supply of only the emergency feed water pump this stock is sufficient for 60 hours. Support and management of supplies The available fuel and oil inventory ensure: − at operation of two emergency DGs (one per each unit) - the total emergency DGs fuel and oil reserve is sufficient for more than 38 days; − the discharge time of batteries at nominal load is more than 10 hours; − the total inventory of fuel and oil for the additional DGs ensure continuous operation of each one of them for more than 4 days; − the total inventory of fuel and oil for the emergency DGs of Units 3 and 4 ensure their continuous operation for 4 days; − the total inventory of fuel and oil for the complementary emergency feed water system ensure continuous operation of the system for more than 5 days; − the total inventory of fuel and oil for the emergency DG of the spent fuel storage facility ensure its continuous operation for 72 hours (3 days); − the safety of the dry spent fuel storage facility does not depend on the availability of power supply and water. The available at Kozloduy NPP Units 5 and 6 water volumes used for decay heat removal by the secondary circuit are: − tanks of the emergency feed water system (TX) – 1300 t total volume; − tank with emergency volume of demineralised water (UA) – 1000 t; − tanks with feed water (deaerators) – 370 t. Water amount required for primary circuit cooling down to оС, which allow start-up of the residual heat removal system does not exceed 724 t (conservative scenario for cooling with two steam generators). Therefore the available water volume is 3.75 times more than the needed. 67 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T If due to dry SGs the secondary heat removal is not possible, the coolant release from the primary circuit through the Pressurizer safety valves could be compensated with borated water, injected by the following systems: − high pressure boron injection system (TQ4) - 3x15=45 t; − medium pressure boron injection system (TQ3) - 3x15=45 t; − tank of the low pressure boron injection system and of the containment spray system – 570 t; − hydro accumulators - 4x50=200 t; − tanks with concentrated boron solution (TB10B01,02) - 200 t; − tanks with boron solution (TB30B01,02) - 250 т. If the residual heat of the reactor core is 18 MW (18 hours after the reactor shut-down), the above mentioned volume of boron solution will be enough for about 51 hours. The fact that the injected boron solution remains in the containment in form of steam or condensate is not considered. Additional amount of demineralised water is available as follows: − tanks for demineralised water (UA21,22,BO1): 1800 t; − tanks for clean condensate in the reactor building (TB40B01,02): 960 t; − tanks for condensate in the auxiliary building (0TR90B01,02): 280 t The amount of the stored dry boric acid is 4 t. The total volume of stored boron solution for injection in the primary circuit of Units 3 and 4 is 1000 m3; The total volume of demineralised water is: − for Units 3 and 4 - 3400 m3; − for spent fuel storage facility - 500 m3 in Auxiliary building 2. Management of radioactive releases Plant design provides for localizing systems, ensuring fulfilment of the established criteria for radioactive discharges into the environment. For implementation of localizing functions, in the containment structure are installed systems and means for monitoring of containment medium parameters, devices for isolation of the containment structure and devices for reduction of the concentration of radioactive fission substances, hydrogen and other substances that could be released into the containment atmosphere during and after design basis and severe accidents. For implementation of these safety functions the following systems are installed: − leaktight enclosure system; − containment spray system; − pressure reduction filtering system; − hydrogen recombination system. In the scope of Modernization Programme, the following measures related to leaktight enclosure system have been implemented: − improvement of the containment test procedure; − qualification of cable channels and planning of replacement; − installation of filtering ventilation; − development and implementation of radiation monitoring system for severe accidents. 68 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T Communication and information systems (on-site and off-site) • Safety Parameters Display System (SPDS) In implementation of its functions, the SPDS continuously measures the safety important technological parameters and by calculating provides information on the Critical Safety Functions. This information is presented at the Main control room and at the Accident Management Centre. • Radiation monitoring systems The Radiation monitoring systems provide information in the dose control boards, where is displayed and archived the information about: − the dose rate and the concentration of radioactive gases and aerosols in the operating and restricted access compartments and in different technological fluids in the Reactor building and in the Auxiliary building; − quantities of gas-aerosol and liquid radioactive releases. This information is presented in the Accident Management Centre. In accordance with the recommendations of EUROATOM 2004 the system is upgraded. • Automated information system for off-site radiation monitoring − The system consists of 2 basic stations and 8 control stations, in which the equivalent dose rate of the gamma radiation and the surface concentration of I-131 is measured. The basic stations are located on the sites of EP-1 and EP-2 (one station per EP). Two of the control stations are located on the NPP territory, and the rest in the preventive actions zone (within radius of 1.8 km from the NPP, at 45º one from the other). − 5 water stations, in which the specific volume activity of the waste process waters is measured. The system is integrated in the National Automated System for continuous monitoring of the radiation gamma background of the Ministry of Environment and Water, thus providing conditions for early notification in case of a radiation accident. The information is presented in the Accident Management Centre. • Automated information system for on-site radiation monitoring The automated information system for on-site radiation monitoring provides information for the gamma background levels in fourteen points around Kozloduy NPP site. The information is presented in the Accident Management Centre. • Meteorological monitoring system The meteorological monitoring system provides information about Kozloduy NPP region, which is necessary for making forecasts for the radioactive transfer and for the dose exposure in the emergency planning area. The system is integrated with the System for meteorological monitoring and the data from the system are submitted to the national institutions. • Environmental and Kozloduy NPP site monitoring Field measurements are conducted on the KNPP site and within the areas of preventive and emergency protective actions by the help of: − three cross-country vehicles; − mobile lab. Laboratory assays of samples collected from the environment and the KNPP site are performed at the Environmental monitoring labs. Sample pre-treatment, radiochemical isolation, concentration and subsequent radiometric and spectrometric measurements are also performed 69 R E P U B L I C O F B U L G A R I A – E XT R A O R D I N A R Y C N S R E P O R T there in conformity with the applicable methodologies. The information is presented in the Accident Management Centre. • AMC Information System The AMC Information System is a complex of technical and software tools for support (ensuring information exchange) of the emergency management team and the staff at the Accident Management Centre. The AMC Information System receives input data from the KNPP SPDS, from the on-line radiation monitoring systems and from the weather monitoring system. The generated output data is used to assess facilities status, radioactive releases and public exposure, which is needed to support decision making and to implement protective actions. • Alarm and communication facilities A modern alarm system is available at Kozloduy NPP site, the objective of which is to ensure high quality and reliable announcement on-site of KNPP and the towns within the 12-km area in case of activation of the Emergency plan. If necessary, all available information communication tools, telephone, radio communication and loudspeaker systems are used to inform the personnel, management and the public. FACTORS THAT CAN HINDER ACCIDENT MANAGEMENT AND EVALUATION OF UNFORESEEN CIRCUMSTANCES Significant damage to infrastructure or flooding around the plant, which may prevent site access Assessments of "Earthquakes" in the range of seismic impacts 0,26